[PATCH 1/2] drm/imagination: Fix ERR_PTR test on pointer to pointer.

[PATCH 1/2] drm/imagination: Fix ERR_PTR test on pointer to pointer.

[Donald Robson]

drivers/gpu/drm/imagination/pvr_vm.c:631 pvr_vm_create_context()
  error: 'vm_ctx->mmu_ctx' dereferencing possible ERR_PTR()

612         vm_ctx->mmu_ctx = pvr_mmu_context_create(pvr_dev);
613         err = PTR_ERR_OR_ZERO(&vm_ctx->mmu_ctx);
                                      ^
The address is never an error pointer so this will always return 0.
Remove the ampersand.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Donald Robson <donald.robson@imgtec.com>
---
 drivers/gpu/drm/imagination/pvr_vm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/imagination/pvr_vm.c b/drivers/gpu/drm/imagination/pvr_vm.c
index 6f4e07effad2..432168aba577 100644
--- a/drivers/gpu/drm/imagination/pvr_vm.c
+++ b/drivers/gpu/drm/imagination/pvr_vm.c
@@ -610,7 +610,7 @@ pvr_vm_create_context(struct pvr_device *pvr_dev, bool is_userspace_context)
 		       0, 1ULL << device_addr_bits, 0, 0, &pvr_vm_gpuva_ops);
 
 	vm_ctx->mmu_ctx = pvr_mmu_context_create(pvr_dev);
-	err = PTR_ERR_OR_ZERO(&vm_ctx->mmu_ctx);
+	err = PTR_ERR_OR_ZERO(vm_ctx->mmu_ctx);
 	if (err) {
 		vm_ctx->mmu_ctx = NULL;
 		goto err_put_ctx;
-- 
2.25.1

[PATCH 2/2] drm/imagination: Fix error path in pvr_vm_create_context

[Donald Robson]

It is possible to double free the vm_ctx->mmu_ctx object in this
function.

    630 err_page_table_destroy:
--> 631         pvr_mmu_context_destroy(vm_ctx->mmu_ctx);

The pvr_vm_context_put() function does:

        kref_put(&vm_ctx->ref_count, pvr_vm_context_release);

Here the pvr_vm_context_release() will call:

        pvr_mmu_context_destroy(vm_ctx->mmu_ctx);

Refactor to an unwind style.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Donald Robson <donald.robson@imgtec.com>
---
 drivers/gpu/drm/imagination/pvr_vm.c | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/drivers/gpu/drm/imagination/pvr_vm.c b/drivers/gpu/drm/imagination/pvr_vm.c
index 432168aba577..93155eccc50d 100644
--- a/drivers/gpu/drm/imagination/pvr_vm.c
+++ b/drivers/gpu/drm/imagination/pvr_vm.c
@@ -598,23 +598,12 @@ pvr_vm_create_context(struct pvr_device *pvr_dev, bool is_userspace_context)
 	if (!vm_ctx)
 		return ERR_PTR(-ENOMEM);
 
-	drm_gem_private_object_init(&pvr_dev->base, &vm_ctx->dummy_gem, 0);
-
 	vm_ctx->pvr_dev = pvr_dev;
-	kref_init(&vm_ctx->ref_count);
-	mutex_init(&vm_ctx->lock);
-
-	drm_gpuvm_init(&vm_ctx->gpuvm_mgr,
-		       is_userspace_context ? "PowerVR-user-VM" : "PowerVR-FW-VM",
-		       0, &pvr_dev->base, &vm_ctx->dummy_gem,
-		       0, 1ULL << device_addr_bits, 0, 0, &pvr_vm_gpuva_ops);
 
 	vm_ctx->mmu_ctx = pvr_mmu_context_create(pvr_dev);
 	err = PTR_ERR_OR_ZERO(vm_ctx->mmu_ctx);
-	if (err) {
-		vm_ctx->mmu_ctx = NULL;
-		goto err_put_ctx;
-	}
+	if (err)
+		goto err_free;
 
 	if (is_userspace_context) {
 		err = pvr_fw_object_create(pvr_dev, sizeof(struct rogue_fwif_fwmemcontext),
@@ -625,13 +614,22 @@ pvr_vm_create_context(struct pvr_device *pvr_dev, bool is_userspace_context)
 			goto err_page_table_destroy;
 	}
 
+	drm_gem_private_object_init(&pvr_dev->base, &vm_ctx->dummy_gem, 0);
+	drm_gpuvm_init(&vm_ctx->gpuvm_mgr,
+		       is_userspace_context ? "PowerVR-user-VM" : "PowerVR-FW-VM",
+		       0, &pvr_dev->base, &vm_ctx->dummy_gem,
+		       0, 1ULL << device_addr_bits, 0, 0, &pvr_vm_gpuva_ops);
+
+	mutex_init(&vm_ctx->lock);
+	kref_init(&vm_ctx->ref_count);
+
 	return vm_ctx;
 
 err_page_table_destroy:
 	pvr_mmu_context_destroy(vm_ctx->mmu_ctx);
 
-err_put_ctx:
-	pvr_vm_context_put(vm_ctx);
+err_free:
+	kfree(vm_ctx);
 
 	return ERR_PTR(err);
 }
-- 
2.25.1

Re: [PATCH 2/2] drm/imagination: Fix error path in pvr_vm_create_context

[Dan Carpenter]

Thanks so much.

Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>

regards,
dan carpenter

Re: (subset) [PATCH 2/2] drm/imagination: Fix error path in pvr_vm_create_context

[Maxime Ripard]

On Wed, 13 Dec 2023 14:44:31 +0000, Donald Robson wrote:
> It is possible to double free the vm_ctx->mmu_ctx object in this
> function.
> 
>     630 err_page_table_destroy:
> --> 631         pvr_mmu_context_destroy(vm_ctx->mmu_ctx);
> 
> The pvr_vm_context_put() function does:
> 
> [...]

Applied to drm/drm-misc (drm-misc-next-fixes).

Thanks!
Maxime

Re: (subset) [PATCH 1/2] drm/imagination: Fix ERR_PTR test on pointer to pointer.

[Maxime Ripard]

On Wed, 13 Dec 2023 14:44:30 +0000, Donald Robson wrote:
> drivers/gpu/drm/imagination/pvr_vm.c:631 pvr_vm_create_context()
>   error: 'vm_ctx->mmu_ctx' dereferencing possible ERR_PTR()
> 
> 612         vm_ctx->mmu_ctx = pvr_mmu_context_create(pvr_dev);
> 613         err = PTR_ERR_OR_ZERO(&vm_ctx->mmu_ctx);
>                                       ^
> The address is never an error pointer so this will always return 0.
> Remove the ampersand.
> 
> [...]

Applied to drm/drm-misc (drm-misc-next-fixes).

Thanks!
Maxime